Information Protection & Security Operations Engineer

The Information Protection & Security Operations Engineer is a hybrid role split roughly 50/50 between two disciplines. Half of your time is spent on information protection: managing and improving Microsoft Purview controls such as Data Loss Prevention (DLP), Insider Risk Management and related data protection policies, so that our customers' and our own sensitive data is protected without getting in the way of how people work. The other half is spent in Security Operations: deploying, configuring, monitoring and maintaining our security solutions, responding to incidents and ensuring vulnerabilities are identified and addressed. You will work closely with our IT colleagues to ensure that security and data protection are integrated into all aspects of the organization's infrastructure and act as guardians of the IT estate and of our data.
The responsibilities of the Information Protection & Security Operations Engineer include:
Information Protection (approx. 50%)
Maintaining, Designing, deploying and tuning Microsoft Purview Data Loss Prevention (DLP) policies across Exchange, SharePoint, OneDrive, Teams, endpoints and cloud apps
Configuring and operating Insider Risk Management, including policy templates, indicators, Adaptive Protection and case triage, in close collaboration with HR, Legal and Compliance
Implementing and maintaining information classification, including sensitivity labels, label policies, auto-labeling and encryption
Managing related protection policies such as retention and records management, communication compliance and Defender for Cloud Apps session and access policies
Monitoring DLP and Insider Risk alerts, investigating policy matches, reducing false positives and reporting on policy effectiveness and data protection posture
Defining and documenting information protection standards, processes and runbooks, and supporting audits and compliance requirements (e.g. ISO 27001, SOC 2, GDPR, NIS2)
Driving user awareness and adoption, including policy tips, guidance and training for business teams
Security Operations (approx. 50%)
Deploying and configuring security solutions such as intrusion detection systems, and endpoint protection
Monitoring security systems to identify and respond to security incidents, including triage of alerts in Microsoft Defender XDR and Microsoft Sentinel
Investigating security incidents and developing remediation plans
Conducting vulnerability assessments and coordinating remediation of findings with infrastructure and application teams
Developing and implementing security policies and procedures
Building and improving detection rules, automation and playbooks to reduce response times
Providing technical guidance and support to other IT professionals
The skills required for an Information Protection & Security Operations Engineer include:
Information Protection
Hands-on experience implementing and operating Microsoft Purview DLP and Insider Risk Management in a production environment
Practical knowledge of sensitivity labels, information classification, encryption and retention concepts
Understanding of data protection and privacy regulations and frameworks (e.g. GDPR, ISO 27001, NIS2) and how they translate into technical controls
Ability to balance security requirements with user productivity and to work sensitively with HR, Legal and Compliance on insider risk topics
Security Operations
Knowledge of security technologies such as firewalls, intrusion detection systems, and endpoint protection
Familiarity with networking and operating systems
Understanding of security principles and best practices
Experience with SIEM and XDR tooling, including KQL queries for investigation and detection
Ability to work under pressure and respond to security incidents quickly
Stay informed about current CVEs and emerging threats, with the ability to track, assess, and ensure coverage to safeguard the organization's security posture
General
Analytical and problem-solving skills
Effective communication and collaboration skills, with the ability to explain data protection and security topics to non-technical stakeholders
Discretion and sound judgement when handling confidential and sensitive information
Educational Backgrounds
A bachelor's degree in computer science, information technology, information security or a related field is typically required for an Information Protection & Security Operations Engineer. Relevant certifications such as Microsoft SC-401 (Information Security Administrator), SC-200 (Security Operations Analyst), AZ-500, CompTIA Security+ or CISSP may also be beneficial.
Information Protection & Security Operations Engineers may use a variety of tools and software, including:
Microsoft Purview: Data Loss Prevention, Insider Risk Management, Information Protection (sensitivity labels), Data Lifecycle Management, Communication Compliance, Audit and eDiscovery
Microsoft Defender XDR (Defender for Endpoint, Office 365, Identity and Cloud Apps)
Security information and event management (SIEM) systems such as Microsoft Sentinel
Microsoft Intune and Entra ID for endpoint and identity-based enforcement
Firewalls such as Cisco ASA, Barracuda NGFW/WAF, Azure Firewall
Intrusion detection and prevention systems such as Snort or Suricata
Vulnerability scanners such as Nessus or Qualys

Employment type
Full-time

Work arrangement
Yes